SST (Other exams) common mistakes
SST · Understand the traps and how to avoid them.
Treating 'safety' and 'security' as interchangeable terms in scenario questions, so answers about fire suppression, egress, or machine guarding get selected for prompts that ask about threat mitigation, and vice versa.
Everyday usage blends the two words, and candidates skim the stem looking for familiar keywords (alarm, camera, evacuation) rather than identifying whether the harm source is accidental or intentional.
What to do instead
Before answering, write one word in the margin: 'accidental' or 'intentional'. Safety controls address unintentional harm (fire, slip, entrapment); security controls address deliberate adversarial action. Eliminate any option whose control type mismatches that label, even if the technology sounds relevant.
Selecting the most advanced or newest technology as the answer to a design question, instead of the control that matches the identified asset, threat, and budget.
Vendors and study material emphasize emerging tech (biometrics, AI analytics, drones), creating a bias that sophistication equals correctness.
What to do instead
Apply a layered-defense test: does the option address the specific threat path named in the stem, at the specific asset, within stated constraints? If the stem gives a budget limit, staffing level, or environment (outdoor, high-traffic, sterile), reject any option that violates it before comparing effectiveness.
Choosing 'deny access' or 'lock down' as the default response to every access-control scenario, including ones involving life safety, evacuation, or accessibility requirements.
Fail-secure thinking is drilled as best practice, so candidates over-apply it and forget fail-safe requirements for egress doors and ADA-type accessibility obligations.
What to do instead
Memorize the rule pair: fail-safe releases on power loss (egress/life safety), fail-secure locks on power loss (high-value assets). When a stem mentions occupants inside, fire alarm interface, or egress path, the correct answer must permit free exit. Check each option against that constraint first.
Jumping to containment or tactical action in incident-response questions without first establishing detection, verification, or notification steps.
Action feels like the 'strong' answer, and candidates confuse decisiveness with correct sequence in the response lifecycle.
What to do instead
Recite the sequence before reading options: detect, verify/assess, notify/activate, contain, eradicate, recover, review. Identify which phase the stem describes, then pick the option that is the correct next step from that phase, not a later-phase action that sounds more impressive.
Confusing the roles of the security operations center, the first responder on scene, and the incident commander, assigning command authority or evidence-handling duties to the wrong party.
Job titles vary across organizations, and candidates map familiar titles onto the exam's role definitions rather than reading the responsibility described.
What to do instead
Anchor on function, not title: who monitors, who physically responds, who directs resources and communicates externally, who preserves the scene. For each option ask 'does this role own this function in the stem's described structure?' If the stem names an incident commander, all coordination answers route there.
Performing a qualitative risk rating without documenting the likelihood and consequence rationale, then selecting a treatment that does not match the rated risk level.
Candidates treat risk scoring as a labeling exercise and skip the reasoning step, so the chosen mitigation is disproportionate or misaligned (e.g., accepting a high risk, over-controlling a low one).
What to do instead
For every risk question, state likelihood and impact explicitly, derive the rating, then map treatment: avoid, reduce, transfer, accept. Verify the option's treatment category matches the rating and that residual risk after treatment is acknowledged. Reject options that accept risk without a stated acceptance authority.
Treating loss prevention as purely external theft control, ignoring internal collusion, process error, paperwork shrinkage, and vendor fraud in scenario answers.
Retail-oriented framing dominates casual understanding, and candidates default to shoplifting or burglary controls when the stem describes inventory discrepancy or unexplained shrink.
What to do instead
Run a loss-source checklist: external theft, internal theft, administrative/paperwork error, vendor fraud, process failure. Match the control to the source the stem implies. If the stem gives no external breach evidence, prioritize audit, segregation of duties, and reconciliation controls over cameras and EAS.
Answering integration questions by naming a device or protocol without addressing compatibility, power, bandwidth, or network segmentation prerequisites.
Candidates memorize product categories and protocol names but not the commissioning dependencies that determine whether an integration actually works.
What to do instead
For any integration option, test four things: does it speak a common protocol or need a gateway; is power (PoE class, load) sufficient; is bandwidth/latency adequate for the data type; and is the device on the correct network segment. Eliminate options that ignore a prerequisite the stem explicitly states.
Skipping or misjudging preventive maintenance and testing intervals, assuming functioning equipment needs no scheduled verification.
Operational systems appear to work, and candidates conflate 'no reported fault' with 'verified performance,' forgetting that detectors, batteries, and lenses degrade silently.
What to do instead
Attach a test to each device class: detection devices need functional testing with calibrated stimuli, backup batteries need load testing, lenses and housings need cleaning and inspection, firmware needs patching cycles. When a stem shows a failure, ask what scheduled test would have caught it and select that maintenance gap.
Answering ethics and compliance items by choosing the option that protects the employer or the client's interest, rather than the option that satisfies the legal or professional obligation.
Loyalty framing and workplace norms push toward confidentiality and discretion, and candidates conflate 'keep it internal' with 'handle it properly.'
What to do instead
Rank obligations: law and regulation first, then professional code and public safety, then employer policy, then commercial interest. If an option involves concealing a reportable event, destroying or altering records, or acting outside scope of competence, eliminate it regardless of how protective it sounds.